The present invention relates to a technology for predicting a CPU abnormality in a data processing system having plural CPUs (central processing units), and more particularly to such a prediction technology that is effectively applicable to a microcomputer integrated, for instance, into a single-chip semiconductor integrated circuit.
When a functionally-distributed system is to be configured with a data processing system having plural CPUs, the individual CPUs are assigned specific functions. For the sake of convenience, functional units implemented by such CPUs and programs are referred to as domains. Each domain may include a specific operating system (OS) and an accelerator. When integrated into a single-chip semiconductor integrated circuit, the functionally-distributed system can meet a demand for functional enhancement and a demand for cost reduction by integration of plural systems. The individual domains communicate with each other to process data while accessing, for instance, their assigned specific memory regions, shared memory regions, and shared resources as needed.
In the above-described system-on-chip (SoC) microcomputer, for example, the data processing result produced by one domain is often used by another domain. Therefore, when, for instance, a data processing operation of a certain domain needs to be performed in real-time, it may be fatally affected by a delay in a data processing operation of another domain. A preventive measure to be taken to avoid the above situation is to preset, for instance, the maximum permissible time between the instant at which a first domain issues a request to a second domain and the instant at which a response arrives. If no response arrives within the maximum permissible time, the microcomputer may conclude that a critical failure has occurred in the first domain, and issue beforehand an associated instruction for performing error handling. However, if the preset maximum permissible time is excessively short, the microcomputer may conclude that a critical failure has occurred even when a temporary memory access concentration or other similar failure has simply occurred in the second domain. If, on the other hand, the preset maximum permissible time is excessively long, the microcomputer may persistently wait for a response from the second domain so that system recovery cannot be achieved due to the loss of a real-time action in the first domain. If a sign of an abnormality of the second domain can be detected in advance, the first domain can perform a preventive process to avoid the abnormality without impairing the real-time action in the first domain. This will contribute to system stability.
A technology for detecting a sign of domain abnormality in advance is described, for instance, in Japanese Unexamined Patent Publication No. Hei 08 (1996)-305675. This technology provides a system health check function that causes a monitoring CPU to transfer a predetermined value to a monitored CPU and allows the monitored CPU to return the transferred value to the monitoring CPU. This enables the monitoring CPU to judge that the monitored CPU is normal.
A technology described in Japanese Unexamined Patent Publication No. Hei 11 (1999)-039032 causes a monitored CPU to transfer its calculated value to a monitoring CPU when a timer times out. The monitoring CPU compares the value transferred from the monitored CPU against a value managed by itself. If the compared values agree with each other, the monitoring CPU judges that the monitored CPU is abnormal, that is, the monitored CPU cannot newly calculate a correct value.